Many issues can arise if we create a CRUD controller to manage the customers directly (see RawCustomersController.cs). First, a little mistake from the client could erase several data points. For example, if the client forgets to send the contracts during a PUT operation, that would delete all the contracts associated with that customer. Here’s the controller code:
// PUT raw/customers/1
[HttpPut(“{id}”)]
public async Task<ActionResult<Customer>> PutAsync(
int id,
[FromBody] Customer value,
ICustomerRepository customerRepository)
{
var customer = await customerRepository.UpdateAsync(
value,
HttpContext.RequestAborted);
if (customer == null)
{
return NotFound();
}
return customer;
}
The highlighted code represents the customer update. So to mistakenly remove all contracts, a client could send the following HTTP request (from the MVC.API.http file):
PUT {{MVC.API.BaseAddress}}/customers/1
Content-Type: application/json
{
“id”: 1,
“name”: “Some new name”,
“contracts”: []
}
That request would result in the following response entity:
{
“id”: 1,
“name”: “Some new name”,
“contracts”: []
}
Previously, however, that customer had contracts (seeded when we started the application). Here’s the original data:
{
“id”: 1,
“name”: “Jonny Boy Inc.”,
“contracts”: [
{
“id”: 1,
“name”: “First contract”,
“description”: “This is the first contract.”,
“status”: {
“totalWork”: 100,
“workDone”: 100,
“state”: “Completed”
},
“primaryContact”: {
“firstName”: “John”,
“lastName”: “Doe”,
“email”: “[email protected]”
}
},
{
“id”: 2,
“name”: “Some other contract”,
“description”: “This is another contract.”,
“status”: {
“totalWork”: 100,
“workDone”: 25,
“state”: “InProgress”
},
“primaryContact”: {
“firstName”: “Jane”,
“lastName”: “Doe”,
“email”: “[email protected]”
}
}
]
}
As we can see, by exposing our entities directly, we are giving a lot of power to the consumers of our API. Another issue with this design is the dashboard. The user interface would have to calculate the statistics about the contracts. Moreover, if we implement paging the contracts over time, the user interface could become increasingly complex and even overquery the database, hindering our performance.
I implemented the entire API, which is available on GitHub but without UI.
Next, we explore how we can fix those two use cases using DTOs.